A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.
AFFECTED_PRODUCTS:
SonicWall Sma 100 Firmware,
SonicWall Sma 200 Firmware,
SonicWall Sma 210 Firmware
... (+3)
A vulnerability in Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to read and modify data in a repository that belongs to an internal service of an affected device.
This vulnerability is due to insufficient enforcement of access control on HTTP req...
AFFECTED_PRODUCTS:
Cisco Catalyst Center
A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass Layer 3 and Layer 4 traffic filters.
This vulnerability is due to improper traffic filtering conditions on an affected device. An attacker could exploit this...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+86)
A vulnerability in the web interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unauthenticated, remote attacker to inject HTML into the browser of an authenticated user.
This vulnerability is due to improper sanitization of input to the web interface. An atta...
AFFECTED_PRODUCTS:
Cisco Catalyst Sd Wan Manager,
Cisco Catalyst Sd Wan Manager,
Cisco Catalyst Sd Wan Manager
... (+279)
A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticated, remote attacker to obtain unauthorized read access to configuration or operational data.
This vulnerability exists because a subtle change in inner API call behavior ca...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+11)
A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. To exploit this vulnerability, the attacker must have valid read-only credentials with...
AFFECTED_PRODUCTS:
Cisco Catalyst Sd Wan Manager,
Cisco Catalyst Sd Wan Manager,
Cisco Catalyst Sd Wan Manager
... (+280)
A vulnerability in the management API of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to read and modify the outgoing proxy configuration settings.
This vulnerability is due to the lack of authentication in an API endpoint. An attacker could ex...
AFFECTED_PRODUCTS:
Cisco Catalyst Center
A vulnerability in Cisco IOS XE Wireless Controller Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device.
This vulnerability is due to insufficient input validation of access point (AP) Cisco Discovery Protocol (CDP) neighbo...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+150)
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device.
This vulnerability is due to insufficient input validation when processing specific conf...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+407)
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device.
This vulnerability is due to insufficient input validation when processing specific conf...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+407)
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device.
This vulnerability is due to insufficient input validation when processing specific conf...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+403)
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device.
This vulnerability is due to insufficient input validation when processing specific conf...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+335)
A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privileges to root on the underlying operating system of an affected device.
This vulnerability is due to insufficient input validation when processing specific conf...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+326)
A vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the Cisco IOx application hosting environment to stop responding, resulting in a denial of service (DoS) condition.
This vulner...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+140)
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a CSRF attack and execute commands on the CLI of an affected device.
This vulnerability is due to insufficient CSRF protections for the web-based management i...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+207)
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker to perform an injection attack against an affected device.
This vulnerability is due to insufficient input validation. An attacker could exploit this vulne...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+95)
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attacker to perform an injection attack against an affected device.r
This vulnerability is due to insufficient input validation. An attacker could exploit this vulner...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+84)
A vulnerability in the Internet Key Exchange version 1 (IKEv1) implementation of Cisco IOS XE Software could allow an authenticated, remote attacker to cause a denial of service (DoS) condition. The attacker must have valid IKEv1 VPN credentials to exploit this vulnerability.
This vulnerability i...
A vulnerability in the Switch Integrated Security Features (SISF) of Cisco IOS Software, Cisco IOS XE Software, Cisco NX-OS Software, and Cisco Wireless LAN Controller (WLC) AireOS Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected...
A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attacker to remove arbitrary users that are defined on an affected device.
This vulnerability is due to insufficient access control of actions executed by lobby...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+4)
A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with Route Switch Processor 3 (RSP3C) could allow an unauthenticated, adjacent attacker to trigger a denial of service (DoS) condition.
This vulnerability is due t...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+263)
A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, remote attacker to upload arbitrary files to an affected system....
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+4)
A vulnerability in the application data endpoints of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to write arbitrary files to an affected system.
This vulnerability is due to improper validation of requests to APIs. An attacker could...
AFFECTED_PRODUCTS:
Cisco Catalyst Sd Wan Manager,
Cisco Catalyst Sd Wan Manager,
Cisco Catalyst Sd Wan Manager
... (+103)
A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote attacker with a lobby ambassador user account to perform a command injection attack against an affected device.
This vulnerability is due to i...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+73)
A vulnerability in the Internet Key Exchange version 2 (IKEv2) protocol processing of Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense (FTD) Software, Cisco IOS Software, and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of se...
AFFECTED_PRODUCTS:
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software,
Cisco Adaptive Security Appliance Software
... (+276)
A vulnerability in Cisco IOS Software for Cisco Catalyst 2960X, 2960XR, 2960CX, and 3560CX Series Switches could allow an authenticated, local attacker with privilege level 15 or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and break the chai...
AFFECTED_PRODUCTS:
Cisco IOS,
Cisco IOS,
Cisco IOS
... (+103)
A vulnerability in the Cisco Industrial Ethernet Switch Device Manager (DM) of Cisco IOS Software could allow an authenticated, remote attacker to elevate privileges.
This vulnerability is due to insufficient validation of authorizations for authenticated users. An attacker could exploit this vul...
A vulnerability in the DHCP snooping security feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a full interface queue wedge, which could result in a denial of service (DoS) condition.
This vulnerability is due to improper handling of DHCP request packets....
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+90)
A vulnerability in certificate validation processing of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an unauthenticated, remote attacker to gain access to sensitive information.
This vulnerability is due to improper validation of certificates that are used by the Smar...
AFFECTED_PRODUCTS:
Cisco Catalyst Sd Wan Manager,
Cisco Catalyst Sd Wan Manager,
Cisco Catalyst Sd Wan Manager
... (+278)
A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to an affected system.
This vulnerability is due to insufficient input validation of the bootstrap file that is read by the system software when a device is firs...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+25)
A vulnerability in the Two-Way Active Measurement Protocol (TWAMP) server feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the affected device to reload, resulting in a denial of service (DoS) condition. For Cisco IOS XR Software, this...
AFFECTED_PRODUCTS:
Cisco IOS,
Cisco IOS XR,
Cisco IOS XR
... (+91)
A vulnerability in the implementation of the Simple Network Management Protocol Version 3 (SNMPv3) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to poll an affected device using SNMP, even if the device is configured to deny SNMP traffic from a...
AFFECTED_PRODUCTS:
Cisco Ios Xe Sd Wan,
Cisco Ios Xe Sd Wan,
Cisco Ios Xe Sd Wan
... (+27)
A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to conduct a stored cross-site scripting attack (XSS) on an affected system.
This vulnerability is due to improper sanitizatio...
AFFECTED_PRODUCTS:
Cisco Catalyst Sd Wan Manager,
Cisco Catalyst Sd Wan Manager,
Cisco Catalyst Sd Wan Manager
... (+276)
A vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unauthenticated, adjacent wireless attacker to cause a denial of service (DoS) condition.
This vulnerability is due to improper memory management. An attacker...
AFFECTED_PRODUCTS:
Cisco Ios Xe,
Cisco Ios Xe,
Cisco Ios Xe
... (+191)
A vulnerability in the access control list (ACL) programming of Cisco IOS Software that is running on Cisco Catalyst 1000 Switches and Cisco Catalyst 2960L Switches could allow an unauthenticated, remote attacker to bypass a configured ACL.
This vulnerability is due to the use of both an IPv4 ACL...
AFFECTED_PRODUCTS:
Cisco IOS,
Cisco IOS,
Cisco IOS
... (+32)
A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker to gain privileges of the root user on the underlying operating system.
This vulnerability is due to insufficient input validation. An authenticated attacker wi...
AFFECTED_PRODUCTS:
Cisco Catalyst Sd Wan Manager,
Cisco Catalyst Sd Wan Manager,
Cisco Catalyst Sd Wan Manager
... (+279)
JRuby-OpenSSL is an add-on gem for JRuby that emulates the Ruby OpenSSL native library. Starting in JRuby-OpenSSL version 0.12.1 and prior to version 0.15.4 (corresponding to JRuby versions starting in 9.3.4.0 prior to 9.4.12.1 and 10.0.0.0 prior to 10.0.0.1), when verifying SSL certificates, JRuby-...
Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with permissi...
syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.a*c.bar` which glib matches but should be avoided / invalidated. This issue could ha...
AFFECTED_PRODUCTS:
Debian Debian Linux,
Oneidentity Syslog Ng
Missing Authorization vulnerability in contentstudio ContentStudio allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ContentStudio: from n/a through 1.3.3.
Improper Control of Generation of Code ('Code Injection') vulnerability in Ultimate Member Ultimate Member allows Code Injection. This issue affects Ultimate Member: from n/a through 2.10.3.
Missing Authorization vulnerability in Saad Iqbal Advanced File Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Advanced File Manager: from n/a through 5.3.1.
AFFECTED_PRODUCTS:
Advancedfilemanager Advanced File Manager
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DELUCKS DELUCKS SEO allows Stored XSS. This issue affects DELUCKS SEO: from n/a through 2.5.9.
Cross-Site Request Forgery (CSRF) vulnerability in Moloni Contribuinte Checkout allows Stored XSS. This issue affects Contribuinte Checkout: from n/a through 2.0.02.
Cross-Site Request Forgery (CSRF) vulnerability in Smaily Smaily for WP allows Cross Site Request Forgery. This issue affects Smaily for WP: from n/a through 3.1.6.
Deserialization of Untrusted Data vulnerability in Florent Maillefaud WP Maintenance allows Object Injection. This issue affects WP Maintenance: from n/a through 6.1.9.7.
Cross-Site Request Forgery (CSRF) vulnerability in Ability, Inc Web Accessibility with Max Access allows Cross Site Request Forgery. This issue affects Web Accessibility with Max Access: from n/a through 2.0.9.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RS WP THEMES RS WP Book Showcase allows DOM-Based XSS. This issue affects RS WP Book Showcase: from n/a through 6.7.40.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gt3themes Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery allows Stored XSS. This issue affects Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery: from n/a through 2.7.7.25.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Faiyaz Alam User Login History allows Stored XSS. This issue affects User Login History: from n/a through 2.1.6.